secure---sso--robinhud-com-auth[.]webflow[.]io

Analysis of secure---sso--robinhud-com-auth.webflow.io shows a brand‑impersonation campaign targeting Robinhood users. The domain was registered on 2026-03-03 through Webflow and resolves to IP 104.18.36.248, an address owned by Cloudflare (ASN 13335) in the United States. SSL termination is provided by Google Trust Services, using the WE1 certificate chain, indicating a legitimate TLS endpoint but offering no protection against abuse. HTTP probing returned a 404 status, and the site is currently listed as offline, suggesting the adversary has withdrawn the payload or is temporarily takedown.

The page title observed during scanning, “Log In | Robinhood® - Sign In to Your Account,” directly references the Robinhood brand, confirming the intent to lure credential‑seeking victims. Security tooling has flagged the domain: 15 of 94 VirusTotal scanners reported malicious activity, and the domain appears on one external blocklist. It is also blocked by PhishDestroy, reinforcing its classification as a credential‑phishing vector.

Detected technologies include Cloudflare’s edge services and HTTP/3 support, common choices for fast‑changing phishing infrastructure. Defenders should add the domain to deny‑list rules at DNS resolvers and web proxies, monitor for any re‑hosting attempts, and enforce strict authentication controls for Robinhood accounts, such as MFA, to mitigate credential compromise. Continuous threat‑intel feeds should be consulted for re‑use of the underlying IP range or certificate, as Cloudflare‑hosted assets are frequently repurposed by malicious actors.